unable to serve request due to an app configuration error. C

Error message

unable to serve request due to an app configuration error. Contact your Teleport administrator

What it means

ErrConfig is a sentinel error in Teleport's LLM app proxy (lib/srv/app/llm/errors). It is returned when the Teleport app or app service itself is misconfigured — e.g. the inference provider credentials, model allowlist, or app integration settings are wrong — so the request cannot be served until an administrator fixes the configuration. It deliberately hides internals from end users and tells them to contact their Teleport administrator.

Source

Thrown at lib/srv/app/llm/errors/errors.go:45

)

var (
	// ErrTimeout returned when the request times out.
	ErrTimeout = errors.New("the request timed out. Try again or use streaming for long responses")
	// ErrBadRequest returned when the request has bad format or invalid fields.
	ErrBadRequest = errors.New("the inference provider rejected the request as invalid. Check the request body for unsupported or invalid fields")
	// ErrCanceled returned when the request is canceled.
	ErrCanceled = errors.New("the request was canceled")
	// ErrUnauthorized returned when the request is unauthorized.
	ErrUnauthorized = errors.New("the inference provider rejected the request due to authentication or authorization configuration. Contact your Teleport administrator")
	// ErrRejected returned when the provider rejects the request.
	ErrRejected = errors.New("the inference provider rejected the request due to usage limits. Contact your Teleport administrator")
	// ErrUnsupported returned when the requested endpoint is not supported.
	ErrUnsupported = errors.New("teleport doesn't support the requested endpoint, please check the list of supported endpoints in the documentation")
	// ErrBadResponse returned when the provider replied the request with an unsupported message or format.
	ErrBadResponse = errors.New("the inference provider returned an unexpected response. Contact your Teleport administrator")
	// ErrConfig returned when the app or app service are misconfigured, requiring admin intervention.
	ErrConfig = errors.New("unable to serve request due to an app configuration error. Contact your Teleport administrator")
	// ErrInternal returned when there is a Teleport processing error (nothing to do with the inference provider).
	ErrInternal = errors.New("unable to serve the request due to an internal error. Contact your Teleport administrator")
	// ErrLimitExceeded returned when Teleport rejects the request due to limit exceeded.
	ErrLimitExceeded = errors.New("tokens quota exceeded. Contact your Teleport administrator")
	// ErrUnknown returned when the handler could not identify the error.
	ErrUnknown = errors.New("the inference provider returned an unexpected error. Contact your Teleport administrator")
)

// ProviderError is an error in the provider format.
type ProviderError struct {
	err    error
	detail string
}

// NewProviderError creates a new provider error with details.
func NewProviderError(err error, detail string, args ...any) *ProviderError {
	if len(args) > 0 {
		detail = fmt.Sprintf(detail, args...)

View on GitHub (pinned to 1283425b60)

Solutions

Check the Teleport app/app_service configuration for the LLM app and ensure the inference provider config file exists and is valid
Verify the app service logs to see which configuration field failed validation
Fix credentials/API keys/model settings in the provider config and restart the app service
If you are the end user, contact your Teleport administrator — nothing on the client side can fix it

Example fix

// before: app config missing inference settings
kind: app
spec:
  uri: http://127.0.0.1
// after: supply the required llm config
kind: app
spec:
  uri: http://127.0.0.1
  llm:
    providers:
      openai:
        api_key_env: OPENAI_API_KEY

Defensive patterns

Strategy: try-catch

Validate before calling

// admin: preflight the app config before users hit the app
// teleport app config must include the llm provider settings file:
if _, err := os.Stat(cfgPath); err != nil {
  return fmt.Errorf("llm provider config missing: %w", err)
}

Type guard

func isAppConfigError(err error) bool {
  return errors.Is(err, llmerrors.ErrConfig)
}

Try / catch

if err := doLLMRequest(ctx, req); err != nil {
  if errors.Is(err, llmerrors.ErrConfig) {
    return fmt.Errorf("app misconfigured; contact your Teleport administrator: %w", err)
  }
  return err
}

Prevention

Validate the LLM app configuration during deployment with a smoke request
Keep provider config files under version control with CI validation
Watch app service logs for config load failures at startup

When it happens

Trigger: Calling the LLM app proxy (NewRequest / findConfigFile path) when the app's provider configuration is missing or invalid, e.g. missing inference config file, bad provider settings, or app service misregistration; the handler wraps provider setup failures with ErrConfig.

Common situations: Admins deploy the llm app without the required config file, misconfigure the app service YAML, or reference a nonexistent provider/model; end users then see this generic contact-your-admin message.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/90be97ac915dfd42. Report an issue: GitHub.